From d89c0b9500434a7b0b25eec58786c6ca303d434a Mon Sep 17 00:00:00 2001
From: "danno@chromium.org"
 <danno@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Date: Thu, 9 Feb 2012 09:11:04 +0000
Subject: [PATCH] Promote double arrays to FAST_ELEMENT that use generic
 KeyedLoadIC

Review URL: https://chromiumcodereview.appspot.com/9111036

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10652 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
---
 src/ic.cc      | 11 +++++++++++
 src/runtime.cc | 14 ++++++++++++--
 2 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/src/ic.cc b/src/ic.cc
index b084109..715c805 100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -1120,6 +1120,17 @@ MaybeObject* KeyedLoadIC::Load(State state,
         } else if (key->IsSmi() && (target() != *non_strict_arguments_stub())) {
           stub = ComputeStub(receiver, LOAD, kNonStrictMode, stub);
         }
+        // If the IC is being replaced by the generic stub, loads from
+        // FAST_DOUBLE_ELEMENTS arrays will cause unboxing in Crankshafted
+        // code. To prevent these expensive allocations, proactively promote
+        // arrays to FAST_ELEMENTS ElementKinds.
+        if (*stub == *generic_stub()) {
+          if (receiver->HasFastDoubleElements()) {
+            MaybeObject* maybe_object =
+                receiver->TransitionElementsKind(FAST_ELEMENTS);
+            if (maybe_object->IsFailure()) return maybe_object;
+          }
+        }
       }
     } else {
       TRACE_GENERIC_IC("KeyedLoadIC", "force generic");
diff --git a/src/runtime.cc b/src/runtime.cc
index d80b4a6..27335c9 100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -4270,14 +4270,24 @@ RUNTIME_FUNCTION(MaybeObject*, Runtime_KeyedGetProperty) {
           // If value is the hole do the general lookup.
         }
       }
-    } else if (FLAG_smi_only_arrays && args.at<Object>(1)->IsSmi()) {
+    } else if (args.at<Object>(1)->IsSmi()) {
+      // Getting properties from FAST_DOUBLE_ELEMENTS arrays causes boxing. To
+      // proactively avoid excessive boxing, transition FAST_DOUBLE_ELEMENTS
+      // arrays to FAST_ELEMENTS if they are accessed via this function, which
+      // is called by the KeyedLoadIC::GenericStub.
+      Handle<JSObject> js_object(args.at<JSObject>(0));
+      if (js_object->HasFastDoubleElements()) {
+        MaybeObject* maybe_object =
+            js_object->TransitionElementsKind(FAST_ELEMENTS);
+        if (maybe_object->IsFailure()) return maybe_object;
+      }
+
       // JSObject without a string key. If the key is a Smi, check for a
       // definite out-of-bounds access to elements, which is a strong indicator
       // that subsequent accesses will also call the runtime. Proactively
       // transition elements to FAST_ELEMENTS to avoid excessive boxing of
       // doubles for those future calls in the case that the elements would
       // become FAST_DOUBLE_ELEMENTS.
-      Handle<JSObject> js_object(args.at<JSObject>(0));
       ElementsKind elements_kind = js_object->GetElementsKind();
       if (elements_kind == FAST_SMI_ONLY_ELEMENTS ||
           elements_kind == FAST_DOUBLE_ELEMENTS) {
-- 
2.7.4